Access Control Management: What It Means for Your ISMS

Share with

Contents

Access control management is the practice of deciding who can reach which information, what they are allowed to do with it, and how long that permission lasts. Every login, file share, database query and server room door falls under it. When access control management works, the right people get their job done without friction and everyone else is quietly kept out.

Most security incidents are not clever technical break-ins. They start with an account that had more rights than it needed, or one that should have been switched off months earlier. That is why access control management sits at the centre of any information security management system rather than at the edge of it. Firewalls and encryption protect the perimeter and the data. Access control decides who is inside the perimeter in the first place.

This page explains how access control management works, the models organisations use, what ISO 27001 asks for, and the practical steps that keep access rights accurate over time.

What Access Control Management Covers

Access control management is usually broken into four questions, asked in order.

Who are you? Identification and authentication. A username claims an identity. A password, token, biometric or one-time code proves it.

What are you allowed to do? Authorisation. Once identity is confirmed, the system checks a set of rules and grants read, write, approve or delete rights.

What did you do? Accountability. Logs record the actions taken under each identity so activity can be traced back to a person.

Do you still need this? Review. Rights granted for a project, a role or a temporary cover arrangement are checked and withdrawn when the reason ends.

The fourth question is the one most organisations skip, and it is where access drift begins.

Why Access Control Management Matters

Access rights accumulate. Someone joins as an analyst, moves to finance, covers a colleague's approvals for a month, then takes a team lead role. Each step adds permissions. Almost nothing removes them. After three years that person can open systems no single role would ever justify.

This matters for three reasons:

A compromised account inherits every right it holds. Broad access turns a small phishing success into a large breach.
Segregation of duties collapses when one person can raise, approve and pay an invoice.
Auditors test access lists against job roles. Mismatches are among the most common findings raised during an ISO 27001 audit.

Strong access control also limits the damage from the threats and vulnerabilities you cannot fully prevent. You may not stop a stolen credential, but you can make sure it opens very little.

Access Control Models You Can Choose From

There is no single correct model. Most organisations use a mix.

Access Control Models You Can Choose From

Role Based Access Control

Permissions attach to roles, and people are assigned roles. A new accounts payable clerk gets the standard clerk role on day one. Role based access control is the most practical model for medium and large teams because it removes case-by-case decisions and makes reviews far easier to run.

Attribute Based Access Control

Access depends on attributes such as department, location, device type or time of day. A finance report might open on a managed laptop inside the office network but not on a personal phone abroad. This model suits distributed teams and cloud services where context matters as much as identity.

Discretionary and Mandatory Access Control

Under discretionary control, the owner of a file decides who else may see it. It is flexible and common in collaboration tools, but it scales badly and creates blind spots. Mandatory access control applies classification labels that users cannot override, which suits defence, government and highly regulated environments.

Privileged Access Management

Administrator, root and database owner accounts need their own treatment. Good practice is to keep them separate from daily-use accounts, issue them for a limited window, require multi-factor authentication and log every session. A small number of privileged accounts, tightly watched, is far safer than administrator rights spread thinly across a department.

The Principle of Least Privilege in Practice

Least privilege means giving each person the minimum access needed to do their job, and nothing more. It sounds obvious and is hard to sustain.

Three habits make it workable:

Start from the role, not the request. Define a baseline permission set for each job title, then handle exceptions individually with an expiry date attached.
Make removal automatic. Tie access to HR events. A leaver record or a transfer should trigger revocation the same day, not at the next quarterly review.
Default to deny. New systems and new folders should start closed. Opening access on request is safer than closing it after a complaint.

Least privilege only works when you know what you are protecting. That is why asset classification usually comes before access design. Public marketing material and customer payment records should never sit under the same rules.

Access Control Management and ISO 27001

ISO 27001 treats access control as a control theme rather than a single requirement. The Annex A controls cover access control policy, identity management, authentication information, access rights, privileged access, source code access and secure log-on procedures, alongside physical security for buildings, server rooms and equipment.

The standard does not tell you which model to use. It asks you to base decisions on risk, document them, apply them consistently and prove that you do. Your risk assessment should therefore drive how strict each control is. High-value systems get multi-factor authentication and monthly reviews. Low-risk internal tools may need far less.

Certification auditors typically ask for four things: the access control policy, a current list of users and their rights for sampled systems, evidence of joiner and leaver processing, and records of periodic access reviews with the actions taken.

Get a Free Personalized Demo to see how access records, reviews and audit evidence stay linked in one place.

Free Demo →

Building an Access Control Policy That People Follow

An access control policy should be short enough to read and specific enough to test. Cover:

Who authorises access for each system and each level of privilege
The joiner, mover and leaver process, with responsible owners and time limits
Password and multi-factor authentication rules
Rules for remote access, personal devices and third party accounts
Review frequency for standard and privileged accounts
What happens when a rule is broken

Keep it consistent with your wider information security policies so staff are not reading contradictory documents. A policy that says "reviewed regularly" gives auditors nothing to test. A policy that says "privileged accounts reviewed monthly by the system owner" does.

Running User Access Reviews

The access review is where the whole system either proves itself or falls apart. A workable review cycle looks like this:

Pull a full user list from the target system, not from your assumptions. Send each list to the manager who actually knows the work, not to IT. Ask a single yes or no question against each line: does this person still need this access. Record every answer, action the removals within an agreed window, and keep the completed review as evidence.

Two practical points from real implementations. First, reviews sent to IT rather than line managers almost always come back approved in full, because IT cannot judge business need. Second, service accounts and shared logins are the ones reviewers skip. List them separately so they cannot be ignored.

Spreadsheet-based reviews work at small scale. Once you cross a few hundred users and several systems, version control and follow-up become the bottleneck, which is where information security management software earns its place by tracking reviews, owners, due dates and closure in one record.

Common Access Control Mistakes

Copying an existing user's permissions to set up a new joiner, which spreads accumulated rights across the team
Leaving contractor and vendor accounts active after a project closes
Shared logins for systems that do not support individual accounts, which destroys accountability
Treating cloud applications as outside scope because IT did not procure them
Reviewing access annually when staff turnover is monthly

Frequently Asked Questions

It is the process of granting, monitoring and removing user permissions across systems and physical spaces. It ensures people can reach only the information their role requires.

The four common models are role based, attribute based, discretionary and mandatory access control. Most organisations combine role based control with attribute rules for remote or high-risk access.

Standard user accounts are usually reviewed every six to twelve months. Privileged and administrator accounts should be reviewed monthly or quarterly because of the damage they can cause.

ISO 27001 does not name specific technologies. It requires authentication strength to match assessed risk, and multi-factor authentication is the accepted answer for privileged and remote access.

It means giving each user the minimum access needed to perform their job. Anything beyond that increases the damage a compromised account can cause.

Share with